AMENDMENTS TO THE CLAIMS 

The following listing of claims will replace all prior versions, and listings, of claims in the 
application. 

1 . (CURRENTLY AMENDED) A computer-implemented method for executing an 
untrusted program, comprising: 

establishing a limited environment within a general environment, wherein said 
limited environment comprises one or more mock resources, wherein said general 
environment comprises one or more real resources, wherein said limited environment and 
said general environment are both provided by the same operating system, and wherein 
programs executing within said limited environment cannot access the one or more real 
resources in said general environment^ wherein said limited environment is a shell in a 
UNDC operating system environment ; 

executing at least a portion of an untrusted program within said limited environment; 

and 

examining said limited environment after execution of at least said portion of said 
untrusted program to check for undesirable behavior exhibited by said untrusted program. 

2-3. (CANCELLED). 

4. (PREVIOUSLY PRESENTED) The method of claim 1, wherein examining said 
limited environment comprises: 

determining whether a particular mock resource of said one or more mock resources 
has been deleted. 
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5. (PREVIOUSLY PRESENTED) The method of claim 1, wherein examining said 
limited environment comprises: 

determining whether a particular mock resource of said one or more mock resources 
has been renamed. 

6. (PREVIOUSLY PRESENTED) The method of claim 1, wherein examining said 
limited environment comprises: 

determining whether a particular mock resource of said one or more mock resources 
has been moved. 

7. (PREVIOUSLY PRESENTED) The method of claim 1 , wherein examining said 
limited environment comprises: 

determining whether a particular mock resource of said one or more mock resources 
has been altered. 

8. (PREVIOUSLY PRESENTED) The method of claim 7, wherein said particular 
mock resource has a parameter associated therewith which changes when said particular 
mock resource is altered, and wherein determining whether said particular mock resource 
has been altered, comprises: 

determining whether said parameter has changed. 

9. (PREVIOUSLY PRESENTED) The method of claim 8, wherein said parameter is a 
time value indicating when said particular mock resource was last updated. 



15437-0508 (P5373) 



3 



10. (PREVIOUSLY PRESENTED) The method of claim 1, wherein examining said 
limited environment comprises: 

determining whether said particular mock resource has been accessed. 

1 1 . (PREVIOUSLY PRESENTED) The method of claim 1 0, wherein said particular 
mock resource contains one or more sets of content, wherein said untrusted program 
executes in a particular portion of memory, and wherein determining whether said particular 
mock resource has been accessed comprises: 

searching said particular portion of said memory for at least one of said one or more 
sets of content. 

1 2. (ORIGINAL) The method of claim 1 , further comprising: 

providing information indicating behavior exhibited by said untrusted program. 

13. (ORIGINAL) The method of claim 12, wherein said information comprises 
indications of undesirable behavior exhibited by said untrusted program. 

14. (ORIGINAL) The method of claim 1 , further comprising: 

determining whether said untrusted program has exhibited undesirable behavior; and 
in response to a determination that said untrusted program has exhibited undesirable 
behavior, taking corrective action. 

15. (ORIGINAL) The method of claim 14, wherein taking corrective action comprises: 
deleting said untrusted program. 
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16. 



(ORIGINAL) The method of claim 14, wherein taking corrective action comprises: 
providing a warning to a user. 



17. (CURRENTLY AMENDED) A computer readable medium comprising instructions 
which, when executed by one or more processors, cause the one or more processors to 
execute an untrusted program, said computer readable medium comprising: 

establishing a limited environment within a general environment, wherein said 
limited environment comprises one or more mock resources, wherein said general 
environment comprises one or more real resources, wherein said limited environment and 
said general environment are both provided by the same operating system, and wherein 
programs executing within said limited environment cannot access the one or more real 
resources in said general environment^ wherein said limited environment is a shell in a 
UNIX operating system environment ; 

executing at least a portion of an untrusted program within said limited environment; 

and 

examining said limited environment after execution of at least said portion of said 
untrusted program to check for undesirable behavior exhibited by said untrusted program. 

18-19. (CANCELLED). 

20. (PREVIOUSLY PRESENTED) The computer readable medium of claim 1 7, 
wherein said instructions for causing one or more processors to examine said limited 
environment comprises: 
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instructions for causing one or more processors to determine whether a particular 
mock resource of said one or more mock resources has been deleted. 

2 1 . (PREVIOUSLY PRESENTED) The computer readable medium of claim 1 7, 
wherein said instructions for causing one or more processors to examine said limited 
environment comprises: 

instructions for causing one or more processors to determine whether a particular 
mock resource of said one or more mock resources has been renamed. 

22. (PREVIOUSLY PRESENTED) The computer readable medium of claim 1 7, 
wherein said instructions for causing one or more processors to examine said limited 
environment comprises: 

instructions for causing one or more processors to determine whether a particular 
mock resource of said one or more mock resources has been moved. 

23 . (PREVIOUSLY PRESENTED) The computer readable medium of claim 1 7, 
wherein said instructions for causing one or more processors to examine said limited 
environment comprises: 

instructions for causing one or more processors to determine whether a particular 
mock resource of said one or more mock resources has been altered. 

24. (PREVIOUSLY PRESENTED) The computer readable medium of claim 23, 
wherein said particular mock resource has a parameter associated therewith which changes 
when said particular mock resource is altered, and wherein said instructions for causing one 
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or more processors to determine whether said particular mock resource has been altered, 
comprises: 

instructions for causing one or more processors to determine whether said parameter 
has changed. 

25 . (PREVIOUSLY PRESENTED) The computer readable medium of claim 24, 
wherein said parameter is a time value indicating when said particular mock resource was 
last updated. 

26. (PREVIOUSLY PRESENTED) The computer readable medium of claim 1 7, 
wherein said instructions for causing one or more processors to examine said limited 
environment comprises: 

instructions for causing one or more processors to determine whether said particular 
mock resource has been accessed. 

27. (PREVIOUSLY PRESENTED) The computer readable medium of claim 26, 
wherein said particular mock resource contains one or more sets of content, wherein said 
untrusted program executes in a particular portion of memory, and wherein said instructions 
for causing one or more processors to determine whether said particular mock resource has 
been accessed comprises: 

instructions for causing one or more processors to search said particular portion of 
said memory for at least one of said one or more sets of content. 

28. (ORIGINAL) The computer readable medium of claim 17, further comprising: 
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instructions for causing one or more processors to provide information indicating 
behavior exhibited by said untrusted program. 

29. (ORIGINAL) The computer readable medium of claim 28, wherein said information 
comprises indications of undesirable behavior exhibited by said untrusted program. 

30. (ORIGINAL) The computer readable medium of claim 17, further comprising: 
instructions for causing one or more processors to determine whether said untrusted 

program has exhibited undesirable behavior; and 

instructions for causing one or more processors to, in response to a determination 
that said untrusted program has exhibited undesirable behavior, take corrective action. 

3 1 . (ORIGINAL) The computer readable medium of claim 30, wherein said instructions 
for causing one or more processors to take corrective action comprises: 

instructions for causing one or more processors to delete said untrusted program. 

32. (ORIGINAL) The computer readable medium of claim 30, wherein said instructions 
for causing one or more processors to take corrective action comprises: 

instructions for causing one or more processors to provide a warning to a user. 

33-36. (CANCELLED). 
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